OFFICE OF MANAGEMENT AND BUDGET CONNECTND HUMAN CAPITAL MANAGEMENT (HCM) Information System Audit As of June 30, 2014

Transcription

1 PROJECT CODE SAI I OFFICE OF MANAGEMENT AND BUDGET CONNECTND HUMAN CAPITAL MANAGEMENT (HCM) Information System Audit As of June 30, 2014 ROBERT R. PETERSON STATE AUDITOR

2 LEGISLATIVE AUDIT AND FISCAL REVIEW COMMITTEE MEMBERS Representative Gary Kreidt Chairman Senator Ralph Kilzer Vice Chairman Representatives Wesley R. Belter Jeff Delzer Ron Guggisberg Patrick Hatlestad Jerry Kelsh Scot Kelsh Keith Kempenich Andrew G. Maragos Bob Martinson Corey Mock Chet Pollert Dan Ruby Jim Schmidt Robert J. Skarphol Wayne Trottier Senators Judy Lee David O'Connell Terry M. Wanzek

3 TABLE OF CONTENTS Transmittal Letter... 1 Executive Summary... 2 Significant Finding... 2 Background Information... 3 System Overview... 3 Financial Summary... 3 Objectives, Scope, and Methodology... 4 Is security designed to provide access based on a demonstrated need to view, add, change, or delete data?... 5 Summary of Audit Work Performed... 5 Audit Finding... 5 Individuals given unnecessary access... 5 Auditor s Opinion... 5 Is the job classification system enforced and managed by ConnectND HCM?... 6 Summary of Audit Work Performed... 6 Auditor s Opinion... 6 Are payroll withholdings and deductions handled timely and accurately?... 7 Summary of Audit Work Performed... 7 Auditor s Opinion... 7 Are leave balances maintained correctly by the system?... 8 Summary of Audit Work Performed... 8 Auditor s Opinion... 8

4 TRANSMITTAL LETTER July 30, 2014 The Honorable Jack Dalrymple, Governor Members of the North Dakota Legislative Assembly Pam Sharp, Director, Office of Management and Budget Transmitted herewith is the information system audit of ConnectND Human Capital Management (HCM) as of June 30, This audit resulted from the statutory responsibility of the State Auditor under NDCC ConnectND HCM is used to maintain and process payroll records for employees of the state of North Dakota. It also contains Enterprise Learning Management for training, Talent Management for employee information, and Recruiting Solutions for hiring. ConnectND HCM was selected for this audit because it is considered a high-risk information system. ConnectND HCM is considered a high-risk information system because it is the payroll system used by the majority of state agencies. High-risk does not necessarily indicate problems with the system, but indicates a higher potential for significant problems to occur. Inquiries or comments relating to this audit may be directed to Donald LaFleur, Information Systems Audit Manager, by calling (701) We wish to express our appreciation to the Office of Management and Budget, and the Information Technology Department for the courtesy, cooperation, and assistance provided to us during this audit. Respectfully submitted, Robert R. Peterson State Auditor 1

5 EXECUTIVE SUMMARY The purpose of this report is to provide our analysis, findings, and recommendations regarding our audit of ConnectND Human Capital Management (HCM). This audit was primarily an information system audit; however, we also addressed operational issues related to the system and its operation within the state of North Dakota. ConnectND HCM is used to maintain and process payroll records for employees of the state of North Dakota. It also contains Enterprise Learning Management for training, Talent Management for employee information, and Recruiting Solutions for hiring. ConnectND HCM was selected for this audit because it is considered a high-risk information system. ConnectND HCM is considered a high-risk information system because it is the payroll system used by the majority of state agencies. High-risk does not necessarily indicate problems with the system, but indicates a higher potential for significant problems to occur. Significant Finding We reviewed the security of ConnectND HCM. We had the following finding: A new security role was improperly implemented. 2

6 CONNECTND HCM BACKGROUND INFORMATION System Overview ConnectND is the state s PeopleSoft Enterprise Resource Planning (ERP) system integrating various administrative processes into one comprehensive system. Initial implementation in 2003 included Financial Administration and base Human Resource (HR) administration. Base HR includes payroll, absence management, and some employee self-service. The ConnectND Portal provides a focal point for access to all areas for which a user has access. The HR component (now called HCM Human Capital Management) has undergone continuous expansion since 2003 and now includes the following modules: Enterprise Learning Management (Jan 2010) training administration for on-line requesting, taking, and recording training. Talent Management (Apr 2012) Employee profile information including competencies, Career Development, eperformance (on-line performance evaluation), and Succession Planning. Recruiting Solutions/Candidate Gateway (Feb 2014) On-line recruiting with public and employee access for submitting job applications, preliminary screening of applicants, managing applicants through the process to hiring. Financial Summary Indicated below is a summary of amounts processed on ConnectND HCM for the fiscal year ended June 30, Transactions from HCM for fiscal year ended June 30,2014 Salaries Permanent $421,127,707 Salaries Other $2,181,285 Temporary Salaries $18,190,281 Overtime $9,577,570 Fringe Benefits $175,313,731 Other $159,851 Grand Total $626,550,425 3

7 CONNECTND HCM OBJECTIVES, SCOPE, AND METHODOLOGY The objective of this audit of ConnectND HCM as of June 30, 2014 was to answer the following questions: 1. Are security roles designed to provide access based on a demonstrated need to view, add, change, or delete data? 2. Is the pay classification system enforced and managed by ConnectND HCM? 3. Are payroll withholdings and deductions handled timely and accurately? 4. Are leave balances maintained correctly by the system? This audit was conducted in accordance with Standards for Information Systems Auditing issued by the Information Systems Audit and Control Association and Government Auditing Standards issued by the Comptroller General of the United States. 4

8 CONNECTND HCM IS SECURITY DESIGNED TO PROVIDE ACCESS BASED ON A DEMONSTRATED NEED TO VIEW, ADD, CHANGE, OR DELETE DATA? Summary of Audit Work Performed We reviewed default accounts to ensure they were being locked in a timely manner. We reviewed policies and procedures for adding, changing, and deleting user access. We reviewed OMB s procedures for performing background checks. We obtained a list of roles that did not require background checks and reviewed access rights for these roles. Audit Finding Individuals given unnecessary access During our review of roles, we noted a role with access to several screens that did not fit the purpose of the role. Individuals with this role had access to perform functions that were not necessary for their job. The role was developed by a consultant and not properly reviewed by the Office of Management and Budget. Access should be granted based on an individuals need to add, change, view, or delete data. Recommendation: We recommend the Office of Management and Budget review roles to ensure access is granted based on a demonstrated need to add, change, view, or delete data. Agency Response: OMB agrees with the recommendation. The role was implemented in conjunction with the rollout of the Recruiting Solutions module of PeopleSoft. The role provided more access than necessary to some agency supervisor/managers, not the general employee population. The role was corrected upon discovery of the issue during implementation. Auditor s Opinion In our opinion, except as noted above, security is designed to provide access based on a demonstrated need to view, add, change, or delete data. 5

9 CONNECTND HCM IS THE JOB CLASSIFICATION SYSTEM ENFORCED AND MANAGED BY CONNECTND HCM? Summary of Audit Work Performed We reviewed ConnectND HCM to see if it enforces the job classifications. We compared employees monthly pay to the job classification to determine that they were properly paid within that range. Although several employees were found outside their range, the Office of Management and Budget was aware of these through their own process for identifying them. Auditor s Opinion In our opinion, the pay classification system is properly enforced and managed. 6

10 CONNECTND HCM ARE PAYROLL WITHHOLDINGS AND DEDUCTIONS HANDLED TIMELY AND ACCURATELY? Summary of Audit Work Performed We reviewed that updates to the tax tables had been applied to the system properly. We also verified that payroll withholdings and deductions were being remitted timely and accurately. Auditor s Opinion In our opinion, payroll withholdings and deductions are handled timely and accurately. 7

11 CONNECTND HCM ARE LEAVE BALANCES MAINTAINED CORRECTLY BY THE SYSTEM? Summary of Audit Work Performed We reviewed leave balances to verify the system was correctly updating the annual leave balances so no more than two hundred and forty hours may be carried forward beyond April 30 of each year. We reviewed leave balances as of May 2014 and found no employees with greater than two hundred and forty hours carried over. We also looked at the donated leave to make sure they were following Century Code and Administrative Code. Auditor s Opinion In our opinion, leave balances are properly maintained by the system. 8

12 You may obtain audit reports on the internet at: or by contacting the Division of State Audit Office of the State Auditor 600 East Boulevard Avenue Department 117 Bismarck, ND (701)